====== SSH ======

===== Use SSH keys =====

In case there is no ''authorized_keys'' file yet, create one:

  * ''mkdir ~/.ssh''
  * ''nano ~/.ssh/authorized_keys''
  * Paste the public key to the file

Set the permissions for the ''.ssh'' folder and the ''authorized_keys'' file:

  * ''chmod 700 ~/.ssh''
  * ''chmod 600 ~/.ssh/authorized_keys''


===== SSH and SCP on Windows with smartcard authentication =====

  * Get pageant from [[https://github.com/risacher/putty-cac|putty-cac]]
  * Import a smartcart certificate
    * Run pageant.exe
    * Right click pageant try icon
    * Add CAPI cert
    * Choose certificate
  * Automatically import a smartcard certificate:
    * Get fingerprint from certificate
      * ''certmgr.msc''
      * Browse to certificate, e.g. "Personal/Certificates" ("Eigene Zertifikate/Zertifikate")
      * Open certificate by double-clicking or right-click and "Open"
      * "Details | Thumbprint" ("Fingerabdruck")
      * Copy fingerprint and remove the spaces
    * Run: ''pageant.exe CAPI:{fingerprint}''
  * PuTTY using smartcard authentication
    * Ensure that pageant.exe is still running in the system tray
    * Run Putty
    * Connection | SSH | Auth | [x] Attempt authencation using Pageant
    * Optionally disable "Attempt keyboard-interactive auth (SSH-2)" to prevent a password login and force the smartcard use
    * Optionally enable "Allow agent forwarding" to enable further logins via smartcard authentication
  * PLink using smartcard authentication
    * Ensure that pageant.exe is still running in the system tray
    * ''plink.exe -agent user@host''
    * Optioanlly use ''-A'' for agent forwarding
  * WinSCP using smartcard authentication:
    * Ensure that pageant.exe is still running in the system tray
    * Advanced settings | SSH | Authentication | [x] Try authentation using Pageant
    * Optionally disable "Attempt keyboard-interactive Authentication" to prevent a password login and force the smartcard use


===== Converting CAPI X509 certificate to SSH public key =====

  * Using OpenSSL
    * Export in Windows
      * certmgr.msc
      * Browse to certificate
      * Open certificate by double-clicking or right-click and "Open"
      * Details
      * Export to file
      * (*) No, don't export private key
      * (*) Base-64 encoded X.509 (.CER)
    * Run: ''openssl x509 -in certificate.cer -pubkey -noout > certificate.pem''
    * Run: ''ssh-keygen -i -m PKCS8 -f certificate.pem''
    * The SSH key is displayed
  * Using PuTTY-CAC
    * Open PuTTY-CAC
    * Connection > SSH > Certificate > Set CAPI Cert...
    * Certificate string for authorized keys file: Copy to Clipboard
===== Using Pageant with SSH in Cygwin and MinGW =====


  * Get ssh-pageant.exe from [[https://github.com/cuviper/ssh-pageant/releases|ssh-pageant]]
  * Cygwin
    * Install in Cygwin (do not copy paste the file via Windows Explorer)
      * $ cp ssh-pageant.exe /usr/bin/
      * $ chmod 755 /usr/bin/ssh-pageant.exe
    * Run ssh-pageant: $ eval $(/usr/bin/ssh-pageant -r -a "/tmp/.ssh-pageant-$USERNAME")
    * Automatically run ssh-pageant: Add the eval command to ~/.bashrc or ~/.bash_profile
    * Alternatively, read the [[https://github.com/cuviper/ssh-pageant/|long description]]
  * MinGW
    * $ eval  $(<path-to>/ssh-pageant.exe -r -a "/tmp/.ssh-pageant-$USERNAME")


===== Using a Proxy with SSH in Cygwin and MinGW =====


  * ''$ ssh -o ProxyCommand='ncat --proxy-type http --proxy proxy-server:proxy-port --proxy-auth proxy-user:proxy-password %h %p' remote-host''
  * ncat is part of [[https://nmap.org/|nmap]]


===== SSH Tunneling =====


  * Create an SSH tunnel from localhost:1234 through jump-server:2233 to remote-host:22
    * ''$ ssh -L 1234:remote-host:22 -p 2233 user@jump-server''
    * ''$ plink -L 1234:remote-host:22 -P 2233 user@jump-server''
  * Use a different known hosts file when creating multiple tunnels: ''$ ssh -o UserKnownHostsFile=~/.ssh/known_hosts_tunnel_remote-host -L 1234:remote-host:22 -p 2233 user@jump-server''
  * SSH into remote-user@remote-host behind jump-user@jump-server: ''$ ssh -J jump-user@jump-server remote-user@remote-host''

SSH config with jump server:
<code>
# SSH into remote-user@remote-host behind jump-user@jump-server
Host my-remote
    ForwardAgend yes
    Hostname remote-host
    User remote-user
    ProxyJump jump-user@jump-server
</code>